windows-exe-decompiler-mcp-server 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CODEX_INSTALLATION.md +69 -0
- package/COPILOT_INSTALLATION.md +77 -0
- package/LICENSE +21 -0
- package/README.md +314 -0
- package/bin/windows-exe-decompiler-mcp-server.js +3 -0
- package/dist/analysis-provenance.d.ts +184 -0
- package/dist/analysis-provenance.js +74 -0
- package/dist/analysis-task-runner.d.ts +31 -0
- package/dist/analysis-task-runner.js +160 -0
- package/dist/artifact-inventory.d.ts +23 -0
- package/dist/artifact-inventory.js +175 -0
- package/dist/cache-manager.d.ts +128 -0
- package/dist/cache-manager.js +454 -0
- package/dist/confidence-semantics.d.ts +66 -0
- package/dist/confidence-semantics.js +122 -0
- package/dist/config.d.ts +335 -0
- package/dist/config.js +193 -0
- package/dist/database.d.ts +227 -0
- package/dist/database.js +601 -0
- package/dist/decompiler-worker.d.ts +441 -0
- package/dist/decompiler-worker.js +1962 -0
- package/dist/dynamic-trace.d.ts +95 -0
- package/dist/dynamic-trace.js +629 -0
- package/dist/env-validator.d.ts +15 -0
- package/dist/env-validator.js +249 -0
- package/dist/error-handler.d.ts +28 -0
- package/dist/error-handler.example.d.ts +22 -0
- package/dist/error-handler.example.js +141 -0
- package/dist/error-handler.js +139 -0
- package/dist/ghidra-analysis-status.d.ts +49 -0
- package/dist/ghidra-analysis-status.js +178 -0
- package/dist/ghidra-config.d.ts +134 -0
- package/dist/ghidra-config.js +464 -0
- package/dist/index.d.ts +9 -0
- package/dist/index.js +200 -0
- package/dist/job-queue.d.ts +169 -0
- package/dist/job-queue.js +407 -0
- package/dist/logger.d.ts +106 -0
- package/dist/logger.js +176 -0
- package/dist/policy-guard.d.ts +115 -0
- package/dist/policy-guard.js +243 -0
- package/dist/process-output.d.ts +15 -0
- package/dist/process-output.js +90 -0
- package/dist/prompts/function-explanation-review.d.ts +5 -0
- package/dist/prompts/function-explanation-review.js +64 -0
- package/dist/prompts/semantic-name-review.d.ts +5 -0
- package/dist/prompts/semantic-name-review.js +63 -0
- package/dist/runtime-correlation.d.ts +34 -0
- package/dist/runtime-correlation.js +279 -0
- package/dist/runtime-paths.d.ts +3 -0
- package/dist/runtime-paths.js +11 -0
- package/dist/selection-diff.d.ts +667 -0
- package/dist/selection-diff.js +53 -0
- package/dist/semantic-name-suggestion-artifacts.d.ts +116 -0
- package/dist/semantic-name-suggestion-artifacts.js +314 -0
- package/dist/server.d.ts +129 -0
- package/dist/server.js +578 -0
- package/dist/tools/artifact-read.d.ts +235 -0
- package/dist/tools/artifact-read.js +317 -0
- package/dist/tools/artifacts-diff.d.ts +728 -0
- package/dist/tools/artifacts-diff.js +304 -0
- package/dist/tools/artifacts-list.d.ts +515 -0
- package/dist/tools/artifacts-list.js +389 -0
- package/dist/tools/attack-map.d.ts +290 -0
- package/dist/tools/attack-map.js +519 -0
- package/dist/tools/cache-observability.d.ts +4 -0
- package/dist/tools/cache-observability.js +36 -0
- package/dist/tools/code-function-cfg.d.ts +50 -0
- package/dist/tools/code-function-cfg.js +102 -0
- package/dist/tools/code-function-decompile.d.ts +55 -0
- package/dist/tools/code-function-decompile.js +103 -0
- package/dist/tools/code-function-disassemble.d.ts +43 -0
- package/dist/tools/code-function-disassemble.js +185 -0
- package/dist/tools/code-function-explain-apply.d.ts +255 -0
- package/dist/tools/code-function-explain-apply.js +225 -0
- package/dist/tools/code-function-explain-prepare.d.ts +535 -0
- package/dist/tools/code-function-explain-prepare.js +276 -0
- package/dist/tools/code-function-explain-review.d.ts +397 -0
- package/dist/tools/code-function-explain-review.js +589 -0
- package/dist/tools/code-function-rename-apply.d.ts +248 -0
- package/dist/tools/code-function-rename-apply.js +220 -0
- package/dist/tools/code-function-rename-prepare.d.ts +506 -0
- package/dist/tools/code-function-rename-prepare.js +279 -0
- package/dist/tools/code-function-rename-review.d.ts +574 -0
- package/dist/tools/code-function-rename-review.js +761 -0
- package/dist/tools/code-functions-list.d.ts +37 -0
- package/dist/tools/code-functions-list.js +91 -0
- package/dist/tools/code-functions-rank.d.ts +34 -0
- package/dist/tools/code-functions-rank.js +90 -0
- package/dist/tools/code-functions-reconstruct.d.ts +2725 -0
- package/dist/tools/code-functions-reconstruct.js +2807 -0
- package/dist/tools/code-functions-search.d.ts +39 -0
- package/dist/tools/code-functions-search.js +90 -0
- package/dist/tools/code-reconstruct-export.d.ts +1212 -0
- package/dist/tools/code-reconstruct-export.js +4002 -0
- package/dist/tools/code-reconstruct-plan.d.ts +274 -0
- package/dist/tools/code-reconstruct-plan.js +342 -0
- package/dist/tools/dotnet-metadata-extract.d.ts +541 -0
- package/dist/tools/dotnet-metadata-extract.js +355 -0
- package/dist/tools/dotnet-reconstruct-export.d.ts +567 -0
- package/dist/tools/dotnet-reconstruct-export.js +1151 -0
- package/dist/tools/dotnet-types-list.d.ts +325 -0
- package/dist/tools/dotnet-types-list.js +201 -0
- package/dist/tools/dynamic-dependencies.d.ts +115 -0
- package/dist/tools/dynamic-dependencies.js +213 -0
- package/dist/tools/dynamic-memory-import.d.ts +10 -0
- package/dist/tools/dynamic-memory-import.js +567 -0
- package/dist/tools/dynamic-trace-import.d.ts +10 -0
- package/dist/tools/dynamic-trace-import.js +235 -0
- package/dist/tools/entrypoint-fallback-disasm.d.ts +30 -0
- package/dist/tools/entrypoint-fallback-disasm.js +89 -0
- package/dist/tools/ghidra-analyze.d.ts +88 -0
- package/dist/tools/ghidra-analyze.js +208 -0
- package/dist/tools/ghidra-health.d.ts +37 -0
- package/dist/tools/ghidra-health.js +212 -0
- package/dist/tools/ioc-export.d.ts +209 -0
- package/dist/tools/ioc-export.js +542 -0
- package/dist/tools/packer-detect.d.ts +165 -0
- package/dist/tools/packer-detect.js +284 -0
- package/dist/tools/pe-exports-extract.d.ts +175 -0
- package/dist/tools/pe-exports-extract.js +253 -0
- package/dist/tools/pe-fingerprint.d.ts +234 -0
- package/dist/tools/pe-fingerprint.js +269 -0
- package/dist/tools/pe-imports-extract.d.ts +105 -0
- package/dist/tools/pe-imports-extract.js +245 -0
- package/dist/tools/report-generate.d.ts +157 -0
- package/dist/tools/report-generate.js +457 -0
- package/dist/tools/report-summarize.d.ts +2131 -0
- package/dist/tools/report-summarize.js +596 -0
- package/dist/tools/runtime-detect.d.ts +135 -0
- package/dist/tools/runtime-detect.js +247 -0
- package/dist/tools/sample-ingest.d.ts +94 -0
- package/dist/tools/sample-ingest.js +327 -0
- package/dist/tools/sample-profile-get.d.ts +183 -0
- package/dist/tools/sample-profile-get.js +121 -0
- package/dist/tools/sandbox-execute.d.ts +441 -0
- package/dist/tools/sandbox-execute.js +392 -0
- package/dist/tools/strings-extract.d.ts +375 -0
- package/dist/tools/strings-extract.js +314 -0
- package/dist/tools/strings-floss-decode.d.ts +143 -0
- package/dist/tools/strings-floss-decode.js +259 -0
- package/dist/tools/system-health.d.ts +434 -0
- package/dist/tools/system-health.js +446 -0
- package/dist/tools/task-cancel.d.ts +21 -0
- package/dist/tools/task-cancel.js +70 -0
- package/dist/tools/task-status.d.ts +27 -0
- package/dist/tools/task-status.js +106 -0
- package/dist/tools/task-sweep.d.ts +22 -0
- package/dist/tools/task-sweep.js +77 -0
- package/dist/tools/tool-help.d.ts +340 -0
- package/dist/tools/tool-help.js +261 -0
- package/dist/tools/yara-scan.d.ts +554 -0
- package/dist/tools/yara-scan.js +313 -0
- package/dist/types.d.ts +266 -0
- package/dist/types.js +41 -0
- package/dist/worker-pool.d.ts +204 -0
- package/dist/worker-pool.js +650 -0
- package/dist/workflows/deep-static.d.ts +104 -0
- package/dist/workflows/deep-static.js +276 -0
- package/dist/workflows/function-explanation-review.d.ts +655 -0
- package/dist/workflows/function-explanation-review.js +440 -0
- package/dist/workflows/reconstruct.d.ts +2053 -0
- package/dist/workflows/reconstruct.js +666 -0
- package/dist/workflows/semantic-name-review.d.ts +2418 -0
- package/dist/workflows/semantic-name-review.js +521 -0
- package/dist/workflows/triage.d.ts +659 -0
- package/dist/workflows/triage.js +1374 -0
- package/dist/workspace-manager.d.ts +150 -0
- package/dist/workspace-manager.js +411 -0
- package/ghidra_scripts/DecompileFunction.java +487 -0
- package/ghidra_scripts/DecompileFunction.py +150 -0
- package/ghidra_scripts/ExtractCFG.java +256 -0
- package/ghidra_scripts/ExtractCFG.py +233 -0
- package/ghidra_scripts/ExtractFunctions.java +442 -0
- package/ghidra_scripts/ExtractFunctions.py +101 -0
- package/ghidra_scripts/README.md +125 -0
- package/ghidra_scripts/SearchFunctionReferences.java +380 -0
- package/helpers/DotNetMetadataProbe/DotNetMetadataProbe.csproj +9 -0
- package/helpers/DotNetMetadataProbe/Program.cs +566 -0
- package/install-to-codex.ps1 +178 -0
- package/install-to-copilot.ps1 +303 -0
- package/package.json +101 -0
- package/requirements.txt +9 -0
- package/workers/requirements-dynamic.txt +11 -0
- package/workers/requirements.txt +8 -0
- package/workers/speakeasy_compat.py +175 -0
- package/workers/static_worker.py +5183 -0
- package/workers/yara_rules/default.yar +33 -0
- package/workers/yara_rules/malware_families.yar +93 -0
- package/workers/yara_rules/packers.yar +80 -0
|
@@ -0,0 +1,175 @@
|
|
|
1
|
+
"""
|
|
2
|
+
Compatibility helpers for environments where the installed speakeasy-emulator
|
|
3
|
+
distribution exposes a namespace package without the top-level Speakeasy class.
|
|
4
|
+
"""
|
|
5
|
+
|
|
6
|
+
from __future__ import annotations
|
|
7
|
+
|
|
8
|
+
import importlib
|
|
9
|
+
import json
|
|
10
|
+
from pathlib import Path
|
|
11
|
+
from types import ModuleType
|
|
12
|
+
from typing import Any, Dict, Optional, Tuple
|
|
13
|
+
|
|
14
|
+
|
|
15
|
+
def _resolve_package_root(module: ModuleType) -> Path:
|
|
16
|
+
module_path = getattr(module, "__file__", None)
|
|
17
|
+
if module_path:
|
|
18
|
+
return Path(module_path).resolve().parent
|
|
19
|
+
|
|
20
|
+
module_search_paths = list(getattr(module, "__path__", []))
|
|
21
|
+
if module_search_paths:
|
|
22
|
+
return Path(module_search_paths[0]).resolve()
|
|
23
|
+
|
|
24
|
+
raise RuntimeError("Unable to resolve speakeasy package root")
|
|
25
|
+
|
|
26
|
+
|
|
27
|
+
def _load_default_config(package_root: Path) -> Dict[str, Any]:
|
|
28
|
+
config_path = package_root / "configs" / "default.json"
|
|
29
|
+
if not config_path.is_file():
|
|
30
|
+
raise RuntimeError(f"Speakeasy default config not found: {config_path}")
|
|
31
|
+
return json.loads(config_path.read_text(encoding="utf-8"))
|
|
32
|
+
|
|
33
|
+
|
|
34
|
+
def load_speakeasy_module() -> Tuple[ModuleType, Dict[str, Any]]:
|
|
35
|
+
"""
|
|
36
|
+
Return an importable speakeasy module plus diagnostics.
|
|
37
|
+
|
|
38
|
+
On some environments the wheel installs `speakeasy` as a namespace package
|
|
39
|
+
without exporting `Speakeasy` from the top level. In that case we inject a
|
|
40
|
+
small compatibility wrapper that recreates the public API used by this
|
|
41
|
+
project.
|
|
42
|
+
"""
|
|
43
|
+
|
|
44
|
+
module = importlib.import_module("speakeasy")
|
|
45
|
+
package_root = _resolve_package_root(module)
|
|
46
|
+
module_path = getattr(module, "__file__", None) or str(package_root)
|
|
47
|
+
|
|
48
|
+
if hasattr(module, "Speakeasy"):
|
|
49
|
+
return module, {
|
|
50
|
+
"import_mode": "direct",
|
|
51
|
+
"module_path": module_path,
|
|
52
|
+
"package_root": str(package_root),
|
|
53
|
+
"warnings": [],
|
|
54
|
+
}
|
|
55
|
+
|
|
56
|
+
from speakeasy.windows.common import PeFile
|
|
57
|
+
from speakeasy.windows.kernel import WinKernelEmulator
|
|
58
|
+
from speakeasy.windows.win32 import Win32Emulator
|
|
59
|
+
|
|
60
|
+
default_config = _load_default_config(package_root)
|
|
61
|
+
|
|
62
|
+
class SpeakeasyCompat:
|
|
63
|
+
"""Small adapter that recreates the top-level Speakeasy API."""
|
|
64
|
+
|
|
65
|
+
def __init__(
|
|
66
|
+
self,
|
|
67
|
+
config: Optional[Dict[str, Any]] = None,
|
|
68
|
+
logger: Any = None,
|
|
69
|
+
argv: Optional[list[str]] = None,
|
|
70
|
+
exit_event: Any = None,
|
|
71
|
+
debug: bool = False,
|
|
72
|
+
) -> None:
|
|
73
|
+
if config is None:
|
|
74
|
+
config_obj = dict(default_config)
|
|
75
|
+
elif isinstance(config, str):
|
|
76
|
+
config_obj = json.loads(config)
|
|
77
|
+
else:
|
|
78
|
+
config_obj = config
|
|
79
|
+
|
|
80
|
+
self.config = config_obj
|
|
81
|
+
self.logger = logger
|
|
82
|
+
self.argv = list(argv or [])
|
|
83
|
+
self.exit_event = exit_event
|
|
84
|
+
self.debug = debug
|
|
85
|
+
self._emu: Any = None
|
|
86
|
+
self._loaded_module: Any = None
|
|
87
|
+
|
|
88
|
+
def _ensure_emu(self) -> Any:
|
|
89
|
+
if self._emu is None:
|
|
90
|
+
raise RuntimeError("No module or shellcode has been loaded into SpeakeasyCompat")
|
|
91
|
+
return self._emu
|
|
92
|
+
|
|
93
|
+
def load_module(self, path: Optional[str] = None, data: Optional[bytes] = None) -> Any:
|
|
94
|
+
pe = PeFile(path=path, data=data)
|
|
95
|
+
if pe.is_driver():
|
|
96
|
+
emu = WinKernelEmulator(
|
|
97
|
+
self.config,
|
|
98
|
+
debug=self.debug,
|
|
99
|
+
logger=self.logger,
|
|
100
|
+
exit_event=self.exit_event,
|
|
101
|
+
)
|
|
102
|
+
else:
|
|
103
|
+
emu = Win32Emulator(
|
|
104
|
+
self.config,
|
|
105
|
+
argv=self.argv,
|
|
106
|
+
debug=self.debug,
|
|
107
|
+
logger=self.logger,
|
|
108
|
+
exit_event=self.exit_event,
|
|
109
|
+
)
|
|
110
|
+
module_obj = emu.load_module(path=path, data=data)
|
|
111
|
+
self._emu = emu
|
|
112
|
+
self._loaded_module = module_obj
|
|
113
|
+
return module_obj
|
|
114
|
+
|
|
115
|
+
def run_module(
|
|
116
|
+
self,
|
|
117
|
+
module_obj: Any = None,
|
|
118
|
+
all_entrypoints: bool = False,
|
|
119
|
+
emulate_children: bool = False,
|
|
120
|
+
) -> Any:
|
|
121
|
+
emu = self._ensure_emu()
|
|
122
|
+
target = module_obj if module_obj is not None else self._loaded_module
|
|
123
|
+
if isinstance(emu, WinKernelEmulator):
|
|
124
|
+
return emu.run_module(target, all_entrypoints=all_entrypoints)
|
|
125
|
+
return emu.run_module(
|
|
126
|
+
target,
|
|
127
|
+
all_entrypoints=all_entrypoints,
|
|
128
|
+
emulate_children=emulate_children,
|
|
129
|
+
)
|
|
130
|
+
|
|
131
|
+
def load_shellcode(self, path: str, arch: str, data: Optional[bytes] = None) -> Any:
|
|
132
|
+
emu = Win32Emulator(
|
|
133
|
+
self.config,
|
|
134
|
+
argv=self.argv,
|
|
135
|
+
debug=self.debug,
|
|
136
|
+
logger=self.logger,
|
|
137
|
+
exit_event=self.exit_event,
|
|
138
|
+
)
|
|
139
|
+
shellcode_addr = emu.load_shellcode(path, arch, data=data)
|
|
140
|
+
self._emu = emu
|
|
141
|
+
self._loaded_module = None
|
|
142
|
+
return shellcode_addr
|
|
143
|
+
|
|
144
|
+
def run_shellcode(self, shellcode_addr: int, offset: int = 0) -> Any:
|
|
145
|
+
emu = self._ensure_emu()
|
|
146
|
+
return emu.run_shellcode(shellcode_addr, offset=offset)
|
|
147
|
+
|
|
148
|
+
def get_report(self) -> Any:
|
|
149
|
+
emu = self._ensure_emu()
|
|
150
|
+
return emu.get_report()
|
|
151
|
+
|
|
152
|
+
def get_json_report(self) -> Any:
|
|
153
|
+
emu = self._ensure_emu()
|
|
154
|
+
return emu.get_json_report()
|
|
155
|
+
|
|
156
|
+
def create_memdump_archive(self) -> Optional[bytes]:
|
|
157
|
+
return None
|
|
158
|
+
|
|
159
|
+
def create_file_archive(self) -> Optional[bytes]:
|
|
160
|
+
return None
|
|
161
|
+
|
|
162
|
+
module.Speakeasy = SpeakeasyCompat
|
|
163
|
+
module.Win32Emulator = Win32Emulator
|
|
164
|
+
module.WinKernelEmulator = WinKernelEmulator
|
|
165
|
+
module.PeFile = PeFile
|
|
166
|
+
|
|
167
|
+
return module, {
|
|
168
|
+
"import_mode": "compat_shim",
|
|
169
|
+
"module_path": module_path,
|
|
170
|
+
"package_root": str(package_root),
|
|
171
|
+
"warnings": [
|
|
172
|
+
"Installed speakeasy-emulator exposes a namespace package without top-level Speakeasy; activated local compatibility shim."
|
|
173
|
+
],
|
|
174
|
+
}
|
|
175
|
+
|